@yagni-app/code-staging 1.2.7-staging.2033.1 → 1.2.7-staging.2056.1

package/dist/extension/pipeline/headlessGo.js

@@ -456,6 +456,13 @@ export async function runHeadlessGo(argv, deps = {}) {
         if (stream)
             emit({ type: "pipeline_log", event, data });
     };
+    // Each command the gate runs, as it starts and ends: a check runs for
+    // minutes with no turn of the model's, and the host's ticket went quiet
+    // through it (YAG-1031). The host shows the command and its verdict.
+    const onCheck = stream
+        ? (event) => logPipeline("verify_check", event)
+        : undefined;
+    const heard = onCheck ? { onCheck } : {};
     // A measurement before the build (the baseline, the plan's checks on the
     // base) gets at most a sixth of the run's time left when it starts, and
     // none below a minute: the build itself must still fit. No deadline, no cap.
@@ -480,7 +487,7 @@ export async function runHeadlessGo(argv, deps = {}) {
         }
         else if (dirs.length > 0) {
             try {
-                const taken = await (deps.takeVerifyBaseline ?? makeTakeVerifyBaseline())(cwd, dirs, deps.signal, share.shareMs);
+                const taken = await (deps.takeVerifyBaseline ?? makeTakeVerifyBaseline(heard))(cwd, dirs, deps.signal, share.shareMs);
                 logPipeline("verify_baseline", {
                     ran: taken.ran,
                     failures: taken.failures,
@@ -518,7 +525,7 @@ export async function runHeadlessGo(argv, deps = {}) {
         }
         else {
             try {
-                const measured = await (deps.measureChecksOnBase ?? makeMeasureChecksOnBase())(cwd, measureFile, deps.signal, share.shareMs);
+                const measured = await (deps.measureChecksOnBase ?? makeMeasureChecksOnBase(heard))(cwd, measureFile, deps.signal, share.shareMs);
                 logPipeline("verify_checks_on_base", {
                     ran: measured.ran,
                     passed: [...measured.passed],
@@ -558,6 +565,7 @@ export async function runHeadlessGo(argv, deps = {}) {
             ...(checksOnBase ? { checksOnBase } : {}),
             ...(scan ? { scanChange: scan } : {}),
             ...(cloud ? { unreadTestFailureIsFinding: true } : {}),
+            ...heard,
         });
         gate = made;
         runVerify = async (verifyCwd, signal, baselinePaths) => {

package/dist/extension/pipeline/verify.d.ts

@@ -158,6 +158,38 @@ export interface VerifyCheckRun {
      */
     note?: string;
 }
+/**
+ * How the note of an approved check this gate run did not run starts (its
+ * budget was spent, it was not reached, the build stopped first, the
+ * typecheck half failed first). The host's pull request body reads these
+ * words (`CHECK_NOT_RUN_NOTE` in @yagni/shared's attempts.ts); a change here
+ * is a change there.
+ */
+export declare const CHECK_NOT_RUN_NOTE = "not run on this tree";
+/**
+ * One command the gate starts or ends, for the session's stream (headlessGo's
+ * `verify_check` line), so the ticket says what runs instead of going quiet
+ * for minutes (YAG-1031). `base` is a run on the unchanged code before the
+ * build. An end that did not pass carries the last few hundred characters
+ * of its output, scrubbed: the host logs them and never shows them.
+ */
+export type VerifyCheckEvent = {
+    phase: "start";
+    name: string;
+    command: string;
+    cwd: string;
+    base?: true;
+} | {
+    phase: "end";
+    name: string;
+    command: string;
+    cwd: string;
+    exitCode: number | null;
+    durationMs: number;
+    baseline?: VerifyCheckRun["baseline"];
+    base?: true;
+    tail?: string;
+};
 /**
  * Why a command threw instead of exiting, as its check record says it. `run`
  * is the run's own signal (a /stop or the run's end); `capped` is the one
@@ -535,6 +567,8 @@ export interface MakeRunVerifyOpts {
      * removes. Absent: no scan half, as before (the cloud session sets it).
      */
     scanChange?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<Finding[] | null>;
+    /** Told as each command starts and ends (the session's stream). Absent: nobody hears it. */
+    onCheck?: (event: VerifyCheckEvent) => void;
 }
 /**
  * One workstream as the scoped checker sees it: the name its findings are
@@ -636,6 +670,8 @@ export interface MakeTakeVerifyBaselineOpts {
     now?: () => number;
     treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
     undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
+    /** Told as each command starts and ends on the clean tree (the session's stream). */
+    onCheck?: (event: VerifyCheckEvent) => void;
 }
 /** What the baseline run found, for the gate and for the run's log. */
 export interface VerifyBaselineResult {
@@ -698,6 +734,8 @@ export interface MakeMeasureChecksOnBaseOpts {
     now?: () => number;
     treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
     undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
+    /** Told as each check starts and ends on the unchanged code (the session's stream). */
+    onCheck?: (event: VerifyCheckEvent) => void;
 }
 /**
  * Run each approved check `checks.json` marks `measureOnBase` once on the

package/dist/extension/pipeline/verify.js

@@ -195,6 +195,44 @@ export function changesGitState(command) {
     }
     return false;
 }
+/**
+ * How the note of an approved check this gate run did not run starts (its
+ * budget was spent, it was not reached, the build stopped first, the
+ * typecheck half failed first). The host's pull request body reads these
+ * words (`CHECK_NOT_RUN_NOTE` in @yagni/shared's attempts.ts); a change here
+ * is a change there.
+ */
+export const CHECK_NOT_RUN_NOTE = "not run on this tree";
+/** How much of a failed command's output its end carries, for the host's own log. */
+const CHECK_TAIL_CHARS = 400;
+/** How a check went the last time it ran, after its not-run note; nothing when it never ran. */
+function earlierRunWords(last) {
+    if (last === undefined)
+        return "";
+    if (last.exitCode === null)
+        return "; it gave no verdict on an earlier tree";
+    if (last.exitCode === 0)
+        return "; it passed on an earlier tree";
+    return `; it failed on an earlier tree (exit ${last.exitCode})`;
+}
+/** The end of a command's output, scrubbed, as a check's end carries it. */
+function checkTail(output) {
+    return scrubSecrets(output).trimEnd().slice(-CHECK_TAIL_CHARS);
+}
+/** A recorded run's end, as the stream hears it: the output's tail only when it did not pass. */
+function checkEnded(record, output) {
+    const tail = output && record.exitCode !== 0 ? checkTail(output) : "";
+    return {
+        phase: "end",
+        name: record.name,
+        command: record.command,
+        cwd: record.cwd,
+        exitCode: record.exitCode,
+        durationMs: record.durationMs,
+        baseline: record.baseline,
+        ...(tail ? { tail } : {}),
+    };
+}
 /**
  * Why a command threw instead of exiting, as its check record says it. `run`
  * is the run's own signal (a /stop or the run's end); `capped` is the one
@@ -1401,6 +1439,54 @@ export function makeRunVerify(opts = {}) {
     // keys from the last call it failed in.
     let repoChecksSpentMs = 0;
     const lastCiFailure = new Map();
+    // Each approved check's last run in this build, by command (trimmed).
+    const lastApproved = new Map();
+    /**
+     * The approved checks as one call reports them, in `checks.json`'s order:
+     * one the sandbox cannot run with no verdict (#2694), one this call ran
+     * with its record, and any other with no verdict on this tree, why, and how
+     * it went the last time it ran. The cloud session's report is the last
+     * call's: one that ran none of them (the build's check budget spent, the
+     * typecheck half failing first) used to drop every one, and a pull request
+     * whose plan named six checks said the session reported none (YAG-1031,
+     * production 2026-10-25). A check that changes the checkout's git state is
+     * never run and never listed.
+     */
+    function approvedRecords(file, ran, why) {
+        return file.checks.flatMap((check) => {
+            if (check.status === "cannot_run") {
+                return [
+                    {
+                        name: checkLabel(check.command),
+                        command: check.command,
+                        cwd: ".",
+                        exitCode: null,
+                        durationMs: 0,
+                        baseline: "cannot_run",
+                        note: `could not run in the sandbox${check.cause ? `: ${check.cause}` : ""}`,
+                    },
+                ];
+            }
+            if (changesGitState(check.command))
+                return [];
+            const key = check.command.trim();
+            const record = ran.get(key);
+            if (record)
+                return [record];
+            const last = lastApproved.get(key);
+            return [
+                {
+                    name: checkLabel(check.command),
+                    command: check.command,
+                    cwd: ".",
+                    exitCode: null,
+                    durationMs: 0,
+                    baseline: last?.baseline ?? measuredBaseline(opts.checksOnBase, check),
+                    note: `${CHECK_NOT_RUN_NOTE}: ${why}${earlierRunWords(last)}`,
+                },
+            ];
+        });
+    }
     /**
      * The repository-checks half: the plan's approved checks, then the pull
      * request's CI steps its changed paths trigger. A failure becomes `critical`
@@ -1417,22 +1503,12 @@ export function makeRunVerify(opts = {}) {
         const labels = [];
         const cannotRun = [];
         // An approved check the sandbox cannot run is on the report as one with no
-        // verdict, so a session that never ran it is never read as all green
-        // (#2694): the host leaves its pull request a draft.
-        const unrunnable = [];
+        // verdict (`approvedRecords`), so a session that never ran it is never
+        // read as all green (#2694): the host leaves its pull request a draft.
         for (const check of file.checks) {
             if (check.status !== "cannot_run")
                 continue;
             cannotRun.push(`\`${check.command}\`${check.cause ? ` (${check.cause})` : ""}`);
-            unrunnable.push({
-                name: checkLabel(check.command),
-                command: check.command,
-                cwd: ".",
-                exitCode: null,
-                durationMs: 0,
-                baseline: "cannot_run",
-                note: `could not run in the sandbox${check.cause ? `: ${check.cause}` : ""}`,
-            });
         }
         const paths = await changedPaths(cwd, signal, input.baselinePaths);
         // A job the pull request's CI reported failed runs whatever its paths say.
@@ -1479,12 +1555,23 @@ export function makeRunVerify(opts = {}) {
         const steps = jobs.flatMap((job) => job.steps.map((step) => ({ job, step })));
         if (approved.length === 0 && steps.length === 0) {
             report();
-            return { findings, reasons, labels, checks: unrunnable };
+            // Every approved check here is one the sandbox cannot run: none is "not run".
+            return {
+                findings,
+                reasons,
+                labels,
+                checks: approvedRecords(file, new Map(), "the sandbox cannot run it"),
+            };
         }
         const buildLeft = (opts.repoChecksBuildBudgetMs ?? REPO_CHECKS_BUILD_BUDGET_MS) - repoChecksSpentMs;
         if (buildLeft < REPO_CHECK_MIN_START_MS) {
             reasons.push("approved checks and CI steps not run again: the build's check budget is spent; the host still runs the approved checks after the build");
-            return { findings, reasons, labels, checks: unrunnable };
+            return {
+                findings,
+                reasons,
+                labels,
+                checks: approvedRecords(file, new Map(), "the build's check budget is spent"),
+            };
         }
         const callBudget = Math.min(opts.repoChecksCallBudgetMs ?? REPO_CHECKS_CALL_BUDGET_MS, timeoutMs - (now() - input.callStartedAt), buildLeft);
         const halfStartedAt = now();
@@ -1500,6 +1587,7 @@ export function makeRunVerify(opts = {}) {
             failedJobs,
             approvedFailed: new Set(),
             checks: [],
+            approvedRuns: new Map(),
         };
         const before = await treeStatus(cwd, signal).catch((err) => {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1533,7 +1621,19 @@ export function makeRunVerify(opts = {}) {
         if (run.notReached > 0) {
             reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget; the host still runs the approved checks after the build`);
         }
-        return { findings, reasons, labels, checks: [...unrunnable, ...run.checks] };
+        const approvedRan = new Set(run.approvedRuns.values());
+        const whyNotRun = signal?.aborted
+            ? "the build stopped first"
+            : "not reached in the gate's time budget";
+        return {
+            findings,
+            reasons,
+            labels,
+            checks: [
+                ...approvedRecords(file, run.approvedRuns, whyNotRun),
+                ...run.checks.filter((record) => !approvedRan.has(record)),
+            ],
+        };
     }
     /**
      * One repository command's verdict: passed, a note (it could not run), or a
@@ -1543,6 +1643,8 @@ export function makeRunVerify(opts = {}) {
      * (`needs` says what). Only the session that measured knows it passed: a
      * resumed session's host carries forward what failed on the base, never
      * what passed, so there the same check is could not run, failing open.
+     * The stream hears the command start, and its end here unless it failed:
+     * a failure's caller tells its end once it decided whose the failure is.
      */
     async function runRepoCommand(run, command, dir, stepEnv, check) {
         const capMs = Math.min(opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS, run.left());
@@ -1550,6 +1652,8 @@ export function makeRunVerify(opts = {}) {
         const env = opts.repoChecksEnv
             ? { ...opts.repoChecksEnv, ...(stepEnv ?? {}) }
             : buildRepoCheckEnv(process.env, run.toolchainFile, stepEnv);
+        const cwd = relative(run.cwd, dir) || ".";
+        opts.onCheck?.({ phase: "start", name: check.name, command, cwd });
         const startedAt = now();
         try {
             const { code, output: rawOutput } = await exec(repoCheckArgv(command), dir, composed, env);
@@ -1557,7 +1661,7 @@ export function makeRunVerify(opts = {}) {
                 const entry = {
                     name: check.name,
                     command,
-                    cwd: relative(run.cwd, dir) || ".",
+                    cwd,
                     exitCode: note ? null : code,
                     durationMs: now() - startedAt,
                     baseline,
@@ -1567,14 +1671,16 @@ export function makeRunVerify(opts = {}) {
                 return entry;
             };
             if (code === 0) {
-                record(check.baseline);
+                const entry = record(check.baseline);
+                opts.onCheck?.(checkEnded(entry));
                 return { kind: "passed" };
             }
             const output = scrubSecrets(rawOutput);
             const cls = classifyTestFailure(output, code, MAX_LOCATED_FINDINGS, env);
             if (cls.kind === "infra" && !(cls.needs && check.passedOnBase)) {
                 const reason = `could not run: ${cls.reason}`;
-                record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
+                const entry = record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
+                opts.onCheck?.(checkEnded(entry, output));
                 return { kind: "note", reason };
             }
             return {
@@ -1587,15 +1693,17 @@ export function makeRunVerify(opts = {}) {
             };
         }
         catch (err) {
-            run.checks.push({
+            const entry = {
                 name: check.name,
                 command,
-                cwd: relative(run.cwd, dir) || ".",
+                cwd,
                 exitCode: null,
                 durationMs: now() - startedAt,
                 baseline: check.baseline,
                 note: unexitedNote(err, run.signal, composed),
-            });
+            };
+            run.checks.push(entry);
+            opts.onCheck?.(checkEnded(entry));
             const msg = err instanceof Error ? err.message : String(err);
             return { kind: "note", reason: `could not run: ${scrubSecrets(msg)}` };
         }
@@ -1628,11 +1736,18 @@ export function makeRunVerify(opts = {}) {
             // The failures it had there, when the session measured it failing.
             const failedOnBase = opts.checksOnBase?.failed.get(check.command.trim());
             const status = measuredBaseline(opts.checksOnBase, check);
+            const recorded = run.checks.length;
             const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
                 name: label,
                 baseline: status,
                 passedOnBase: opts.checksOnBase?.passed.has(check.command.trim()) ?? false,
             });
+            // `runRepoCommand` records every run once, whatever its verdict.
+            const ran = run.checks[recorded];
+            if (ran) {
+                run.approvedRuns.set(check.command.trim(), ran);
+                lastApproved.set(check.command.trim(), ran);
+            }
             if (verdict.kind === "failed")
                 run.approvedFailed.add(canonicalCheckCommand(check.command));
             if (verdict.kind === "failed" && verdict.needs) {
@@ -1668,6 +1783,8 @@ export function makeRunVerify(opts = {}) {
                     run.findings.push(...found.slice(0, findingRoom(run)));
                 }
             }
+            if (verdict.kind === "failed")
+                opts.onCheck?.(checkEnded(verdict.record, verdict.output));
         }
     }
     /**
@@ -1742,6 +1859,7 @@ export function makeRunVerify(opts = {}) {
                 continue;
             }
             settle(job, "failed");
+            opts.onCheck?.(checkEnded(verdict.record, verdict.output));
             const stepFindings = repoFailureFindings(run, verdict, step.name, where, dir);
             const keys = new Set(stepFindings.map((f) => f.message));
             const previous = lastCiFailure.get(key);
@@ -1791,15 +1909,27 @@ export function makeRunVerify(opts = {}) {
             const counts = opts.baseline?.get(verifyCommandKey(command));
             return counts && [...counts.values()].some((n) => n > 0) ? "fails_on_base" : "runnable";
         };
-        const recordCommand = (command, code, startedAt, baseline, note) => checks.push({
+        /** A detected command starting, as the stream hears it. */
+        const commandStarted = (command) => opts.onCheck?.({
+            phase: "start",
             name: command.label,
             command: command.argv.join(" "),
             cwd: relative(cwd, command.cwd) || ".",
-            exitCode: code,
-            durationMs: now() - startedAt,
-            baseline,
-            ...(note ? { note } : {}),
         });
+        /** A detected command's record, its end told to the stream with its output's tail. */
+        const recordCommand = (command, code, startedAt, baseline, more = {}) => {
+            const entry = {
+                name: command.label,
+                command: command.argv.join(" "),
+                cwd: relative(cwd, command.cwd) || ".",
+                exitCode: code,
+                durationMs: now() - startedAt,
+                baseline,
+                ...(more.note ? { note: more.note } : {}),
+            };
+            checks.push(entry);
+            opts.onCheck?.(checkEnded(entry, more.output));
+        };
         // TYPECHECK HALF (frozen behavior, §0.2): run every changed package's build
         // check; union the findings. One package that cannot spawn fails OPEN (a
         // recorded reason, no finding) without sinking the verdict for the packages
@@ -1808,6 +1938,7 @@ export function makeRunVerify(opts = {}) {
         const typecheckEnv = buildGateVerifyEnv(process.env, toolchainFile);
         for (const command of commands) {
             const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
+            commandStarted(command);
             const startedAt = now();
             try {
                 const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, typecheckEnv);
@@ -1820,11 +1951,14 @@ export function makeRunVerify(opts = {}) {
                     const infra = classifyVerifyInfraFailure(output, code);
                     if (infra) {
                         reasons.push(`verify (${command.label}) could not run: ${infra}`);
-                        recordCommand(command, null, startedAt, "cannot_run", `could not run: ${infra}; ${exitSummary(command.label, code, output)}`);
+                        recordCommand(command, null, startedAt, "cannot_run", {
+                            note: `could not run: ${infra}; ${exitSummary(command.label, code, output)}`,
+                            output,
+                        });
                         continue;
                     }
                 }
-                recordCommand(command, code, startedAt, standing(command));
+                recordCommand(command, code, startedAt, standing(command), { output });
                 anyRan = true;
                 typecheckLabels.push(command.label);
                 if (code !== 0) {
@@ -1835,7 +1969,9 @@ export function makeRunVerify(opts = {}) {
                 }
             }
             catch (err) {
-                recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
+                recordCommand(command, null, startedAt, standing(command), {
+                    note: unexitedNote(err, signal, composed),
+                });
                 const msg = err instanceof Error ? err.message : String(err);
                 reasons.push(`verify (${command.label}) could not run: ${scrubSecrets(msg)}`);
             }
@@ -1871,13 +2007,17 @@ export function makeRunVerify(opts = {}) {
                         continue;
                     }
                     const composed = composeAbortSignal(signal, AbortSignal.timeout(testTimeoutMs));
+                    commandStarted(command);
                     const startedAt = now();
                     try {
                         const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, testEnv);
                         const output = scrubSecrets(rawOutput);
                         const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, testEnv);
                         if (cls.kind === "infra") {
-                            recordCommand(command, null, startedAt, "cannot_run", `could not run: ${cls.reason}; ${exitSummary(command.label, code, output)}`);
+                            recordCommand(command, null, startedAt, "cannot_run", {
+                                note: `could not run: ${cls.reason}; ${exitSummary(command.label, code, output)}`,
+                                output,
+                            });
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
                             continue;
                         }
@@ -1887,19 +2027,22 @@ export function makeRunVerify(opts = {}) {
                             testLabels.push(command.label);
                             if (base === "fails_on_base") {
                                 const summary = exitSummary(command.label, code, output);
-                                recordCommand(command, code, startedAt, base, `failed on the unchanged code too: ${summary}`);
+                                recordCommand(command, code, startedAt, base, {
+                                    note: `failed on the unchanged code too: ${summary}`,
+                                    output,
+                                });
                                 reasons.push(`tests (${where}) failed on the unchanged code too, so not a finding: ${summary}`);
                             }
                             else {
                                 // One finding per command, past the cap too: it is the only
                                 // word of this command's failure.
-                                recordCommand(command, code, startedAt, base);
+                                recordCommand(command, code, startedAt, base, { output });
                                 testFindingCount += 1;
                                 findings.push(tailFinding(command.label, code, output));
                             }
                             continue;
                         }
-                        recordCommand(command, code, startedAt, base);
+                        recordCommand(command, code, startedAt, base, { output });
                         if (cls.kind === "uncertain") {
                             // Failing OPEN on an uninterpretable failure (§3d): an honest note,
                             // never a guessed finding the fix stage cannot clear.
@@ -1918,7 +2061,9 @@ export function makeRunVerify(opts = {}) {
                         }
                     }
                     catch (err) {
-                        recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
+                        recordCommand(command, null, startedAt, standing(command), {
+                            note: unexitedNote(err, signal, composed),
+                        });
                         const msg = err instanceof Error ? err.message : String(err);
                         reasons.push(`tests (${where}) could not run: ${scrubSecrets(msg)}`);
                     }
@@ -1932,6 +2077,7 @@ export function makeRunVerify(opts = {}) {
         if (repoFile) {
             if (typecheckFailed) {
                 reasons.push("approved checks and CI steps skipped: the typecheck half failed; a later round runs them");
+                checks.push(...approvedRecords(repoFile, new Map(), "the typecheck half failed first"));
             }
             else {
                 const repo = await runRepoChecks({
@@ -2056,7 +2202,8 @@ export function makeTakeVerifyBaseline(opts = {}) {
             for (const { command, test } of runs) {
                 if (signal?.aborted)
                     break;
-                const left = budgetMs - (now() - startedAt);
+                const commandStartedAt = now();
+                const left = budgetMs - (commandStartedAt - startedAt);
                 if (left < REPO_CHECK_MIN_START_MS) {
                     result.notes.push(`${command.label} (${command.cwd}): not reached in the baseline budget`);
                     continue;
@@ -2065,8 +2212,23 @@ export function makeTakeVerifyBaseline(opts = {}) {
                     ? (opts.testTimeoutMs ?? VERIFY_TEST_TIMEOUT_MS)
                     : (opts.timeoutMs ?? VERIFY_TIMEOUT_MS), left);
                 const composed = composeAbortSignal(signal, AbortSignal.timeout(cap));
+                const heard = {
+                    name: command.label,
+                    command: command.argv.join(" "),
+                    cwd: relative(cwd, command.cwd) || ".",
+                    base: true,
+                };
+                opts.onCheck?.({ phase: "start", ...heard });
+                const ended = (exitCode, output) => opts.onCheck?.({
+                    phase: "end",
+                    ...heard,
+                    exitCode,
+                    durationMs: now() - commandStartedAt,
+                    ...(output && exitCode !== 0 ? { tail: checkTail(output) } : {}),
+                });
                 try {
                     const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, test ? testEnv : verifyEnv);
+                    ended(code, rawOutput);
                     const output = scrubSecrets(rawOutput);
                     let failed;
                     if (test) {
@@ -2095,6 +2257,7 @@ export function makeTakeVerifyBaseline(opts = {}) {
                         result.failures += n;
                 }
                 catch (err) {
+                    ended(null);
                     const msg = err instanceof Error ? err.message : String(err);
                     result.notes.push(`${command.label} (${command.cwd}): could not run: ${scrubSecrets(msg)}`);
                 }
@@ -2170,14 +2333,25 @@ export function makeMeasureChecksOnBase(opts = {}) {
                     break;
                 const command = check.command.trim();
                 const label = checkLabel(check.command);
-                const left = budgetMs - (now() - startedAt);
+                const checkStartedAt = now();
+                const left = budgetMs - (checkStartedAt - startedAt);
                 if (left < REPO_CHECK_MIN_START_MS) {
                     result.notes.push(`\`${label}\`: not reached in the budget`);
                     continue;
                 }
                 const composed = composeAbortSignal(signal, AbortSignal.timeout(Math.min(opts.timeoutMs ?? REPO_CHECK_TIMEOUT_MS, left)));
+                const heard = { name: label, command: check.command, cwd: ".", base: true };
+                opts.onCheck?.({ phase: "start", ...heard });
+                const ended = (exitCode, output) => opts.onCheck?.({
+                    phase: "end",
+                    ...heard,
+                    exitCode,
+                    durationMs: now() - checkStartedAt,
+                    ...(output && exitCode !== 0 ? { tail: checkTail(output) } : {}),
+                });
                 try {
                     const { code, output: rawOutput } = await exec(repoCheckArgv(check.command), cwd, composed, env);
+                    ended(code, rawOutput);
                     if (code === 0) {
                         passed.add(command);
                         result.ran.push(label);
@@ -2206,6 +2380,7 @@ export function makeMeasureChecksOnBase(opts = {}) {
                     result.ran.push(label);
                 }
                 catch (err) {
+                    ended(null);
                     result.notes.push(`\`${label}\`: ${unexitedNote(err, signal, composed)}`);
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.7-staging.2033.1",
+  "version": "1.2.7-staging.2056.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "67b28e4d87817ddc9be0c0cb8ef367a50e8ce928"
+  "yagniSourceSha": "76a36c6b94db739ea0fb0544cbe9a26279e6881c"
 }